Applied Cybernetics Group
T1480.002 Mutual Exclusion
coverage gap
- Technique
T1480.002- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 0
- Elastic, Splunk
- 0
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1480/002
MITRE description
Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes) While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.(Citation: Microsoft Mutexes) By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.(Citation: Sans Mutexes 2012) In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.(Citation: Intezer RedXOR 2021)(Citation: Deep Instinct BPFDoor 2023) Mutex names may be hard-coded or dynamically generated using a predictable algorithm.(Citation: ICS Mutexes 2015)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
Detection coverage
No rule covers this technique yet. No SigmaHQ, Elastic or Splunk production rule carries its tag, and thrunt hasn't written one. Techniques like this are where the next thrunt rules come from; the gap map has the full list.